LLMSecurityGuide - A comprehensive reference for securing Large Langu

项目说明

🛡️ LLM Security 101: The Complete Guide (2026 Edition)

<di="center">

!LLM Security
!Agentic AI
!OWASP 2025
!License
!Contributions
!Updated

A comprehensi to offensive and defensi for Large Language Models and Agentic AI Systems, updated for February 2026 with the OWASP Top 10 for LLMs 2025, corrected OWASP Top 10 for Agentic Applications 2026 (ASI prefix), new security tools, recent incidents, and AI regulation co.

O • What's New • Quick Start • OWASP LLM 2025 • 🆕 OWASP Agentic 2026 • Tools • Resources

</div>

---

🚨 BREAKING UPDATE - February 2026

> ⚡ MAJOR UPDATE: This guide has been significantly updated with critical corrections and new content for 2026. The OWASP Agentic Top 10 identifiers have been corrected from the unofficial "AAI" prefix to the official "ASI" (Agentic Security Issue) prefix with proper ordering per the December 2025 release. New sections co R1 security concerns, recent AI security incidents, emerging red teaming tools, and AI regulations.

🆕 What's New in This Update

| Addition | Description |
|----------|-------------|
| 🔴 ASI Prefix Correction | Fixed OWASP Agentic Top 10 from incorrect AAI to official ASI identifiers with correct ordering |
| 🆕 New Security Tools | DeepTeam, Promptfoo, ARTKIT, Meta LlamaFirewall/Llama Guard 4 |
| 🆕 New Case Studies | EchoLeak (C), DeepSeek R1 , first malicious MCP server |
| 🆕 AI Regulations | EU AI Act 2026 milestones, NIST AI RMF, ISO/IEC 42001 |
| 🔄 Updated LLM Ecosystem | GPT-5.x, Claude Opus 4.6, Gemini 3.x, Llama 4 models |
| 📈 Updated Resources | New research references, red teaming tools, and regulatory resources |

This guide covers the OWASP Top 10 for LLM Applications 2025 (released No 18, 2024) and the OWASP Top 10 for Agentic Applications 2026 (released December 10, 2025). Key topics include Agentic AI Security, RAG , System Prompt Leakage, /Embedding Weaknesses, and AI Compliance.

---

📋 Table of Contents

---

🎯 O

As Large Language Models become the backbone of enterprise applications, from customer service chatbots to code generation assistants, the security implications ha dramatically. This guide provides a comprehensi for:

Why This Guide Matters

---

🆕 What's New in 2025/2026

OWASP Top 10 for LLMs 2025 Major Updates

The No 2024 release introduced significant changes reflecting real-world AI deployment patterns:

#### 🆕 New Critical Risks

#### 🔄 Expanded Threats

#### 📈 Emerging Attack

🆕 OWASP Top 10 for Agentic Applications 2026 (December 2025)

Released at Black Hat Europe on December 10, 2025, this globally peer-re framework identifies critical security risks facing autonomous AI systems:

| Rank | | Description |
|------|--------------|-------------|
| ASI01 | Agent Goal Hijack | Redirecting agent objectives injection, deceptive tool outputs, or poisoned data |
| ASI02 | Tool Misuse & Exploitation | Agents misusing legitimate tools due to prompt injection, misalignment, or unsafe delegation |
| ASI03 | Identity & Pri Abuse | Exploiting inherited/cached credentials, delegated permissions, or agent-to-agent trust |
| ASI04 | Agentic Supply Chain | Malicious or tampered tools, descriptors, models, or agent personas |
| ASI05 | Unexpected Code Execution | Agents generating or executing attacker-controlled code |
| ASI06 | Memory & Context Poisoning | Persistent corruption of agent memory, RAG stores, or contextual knowledge |
| ASI07 | Insecure Inter-Agent Communication | Spoofed inter-agent messages misdirecting entire clusters |
| ASI08 | Cascading Failures | False signals cascading through automated pipelines with escalating impact |
| ASI09 | Human-Agent Trust Exploitation | Confident, polished explanations misleading human operators into approving harmful actions |
| ASI10 | Rogue Agents | Compromised or misaligned agents di from intended behavior |

The framework introduces the principle of "least agency" — only granting agents the minimum autonomy required for safe, bounded tasks.

New Security Technologies

#### Latest Security Tools (2024-2026)

#### 🆕 Red Teaming & Offensi (2025-2026)

#### Enhanced Frameworks

---

🤖 Understanding LLMs

What is a Large Language Model?

Large Language Models (LLMs) are ad AI systems trained on vast datasets to understand and generate human-like text. Modern LLMs power:

Current LLM Ecosystem

| Category | Examples | Key Characteristics |
|--------------|--------------|------------------------|
| Foundation Models | GPT-5.x, Claude Opus 4.6, Llama 4 | General-purpose, up to 1M+ token context windows |
| Specialized Models | Codex, Med-PaLM 2, FinGPT | Domain-specific optimization |
| Multimodal Models | GPT-5, Claude Opus 4.6, Gemini 3.x | Text, image, audio, video processing |
| Agentic Systems | Claude Code, OpenAI Codex agent, LangChain Agents | Autonomous multi-step task execution |
| RAG Systems | Enterprise search, Q&A bots | External knowledge integration |

🆕 What is Agentic AI?

Agentic AI represents an ad in autonomous systems where AI operates with agency—planning, reasoning, using tools, and executing multi-step actions with minimal human inter. Unlike traditional LLM applications that respond to single prompts, agentic systems:

#### Why Agentic AI Changes the Threat Landscape

| Aspect | Traditional LLM | Agentic AI |
|--------|-----------------|------------|
| State | Stateless (request/response) | Stateful (persistent memory) |
| Behavior | Reactive | Autonomous |
| Scope | Single interaction | Multi-step workflows |
| Propagation | Isolated | Cascading across agents |
| Detection | Easier (single point) | Harder (distributed actions) |

Security Implications

Modern LLM deployments introduce unique attack surfaces:

---

🚨 OWASP Top 10 for LLMs 2025

The OWASP Top 10 for Large Language Model Applications 2025 represents the collaborative work of 500+ global experts and reflects the current threat landscape.

Complete 2025 Rankings

| Rank | | Status | Description |
|----------|------------------|------------|------------------|
| LLM01 | Prompt Injection | 🔴 Unchanged | Manipulating LLM behavior through crafted inputs |
| LLM02 | Sensiti Disclosure | 🔴 Updated | Exposure of PII, credentials, and proprietary data |
| LLM03 | Supply Chain | 🔴 Enhanced | Compromised models, datasets, and dependencies |
| LLM04 | Data and Model Poisoning | 🔴 Refined | Malicious training data and backdoor attacks |
| LLM05 | Improper Output Handling | 🔴 Updated | Insufficient of LLM-generated content |
| LLM06 | Excessi | 🆕 Expanded | Unchecked autonomous AI agent permissions |
| LLM07 | System Prompt Leakage | 🆕 NEW | Exposure of sensiti prompts and configs |
| LLM08 | and Embedding Weaknesses | 🆕 NEW | RAG-specific and data leakage |
| LLM09 | Misinformation | 🆕 NEW | Hallucination, bias, and o risks |
| LLM10 | Unbounded Consumption | 🔴 Expanded | Resource exhaustion and economic attacks |

Key Changes from 2023

#### Removed from Top 10:

#### Major Expansions:

---

🆕 OWASP Top 10 for Agentic Applications 2026

> ⚡ Released December 10, 2025 at Black Hat Europe

The OWASP GenAI Security Project's Agentic Security Initiati this framework through input from 100+ security researchers and by NIST, European Commission, and Alan Turing Institute.

Complete Agentic Top 10

| Rank | | Risk Level | Description |
|----------|------------------|----------------|-----------------|
| ASI01 | 🎯 Agent Goal Hijack | 🔴 CRITICAL | Redirecting agent objectives injection, deceptive tool outputs, or poisoned data |
| ASI02 | 🔧 Tool Misuse & Exploitation | 🔴 CRITICAL | Agents misusing legitimate tools due to prompt injection, misalignment, or unsafe delegation |
| ASI03 | 🔑 Identity & Pri Abuse | 🔴 CRITICAL | Exploiting inherited/cached credentials, delegated permissions, or agent-to-agent trust |
| ASI04 | 📦 Agentic Supply Chain | 🟠 HIGH | Malicious or tampered tools, descriptors, models, or agent personas |
| ASI05 | 💻 Unexpected Code Execution | 🟠 HIGH | Agents generating or executing attacker-controlled code |
| ASI06 | 💾 Memory & Context Poisoning | 🟠 HIGH | Persistent corruption of agent memory, RAG stores, or contextual knowledge |
| ASI07 | 📡 Insecure Inter-Agent Communication | 🟠 HIGH | Spoofed inter-agent messages misdirecting entire clusters |
| ASI08 | ⚡ Cascading Failures | 🟡 MEDIUM | False signals cascading through automated pipelines with escalating impact |
| ASI09 | 🧠 Human-Agent Trust Exploitation | 🟡 MEDIUM | Confident, polished explanations misleading human operators into approving harmful actions |
| ASI10 | 👾 Rogue Agents | 🔴 CRITICAL | Compromised or misaligned agents di from intended behavior |

Mapping LLM Top 10 to Agentic Top 10

| LLM | Related Agentic | Key Difference |
|------------------|------------------------------|----------------|
| LLM01: Prompt Injection | ASI01: Agent Goal Hijack | Agentic extends to multi-step reasoning manipulation |
| LLM06: Excessi | ASI03: Identity & Pri Abuse | Adds NHI and dynamic permission concerns |
| LLM03: Supply Chain | ASI04: Agentic Supply Chain | Adds MCP servers, agent plugins |
| LLM05: Improper Output | ASI05: Unexpected Code Execution | Focuses on code generation/execution |
| *New* | ASI02: Tool Misuse & Exploitation | Unique to tool-using agents |
| *New* | ASI06: Memory & Context Poisoning | Unique to stateful agents |
| *New* | ASI10: Rogue Agents | Unique to autonomous systems |

Key Differences: LLM Threats

The top three concerns differ fundamentally:

| Traditional LLM Top 3 | Agentic AI Top 3 |
|----------------------|------------------|
| 1. Prompt Injection | 1. Agent Goal Hijack (multi-step reasoning manipulation) |
| 2. Sensitive Info Disclosure | 2. Tool Misuse & Exploitation (lateral mo, RCE) |
| 3. Supply Chain | 3. Identity & Pri Abuse (dynamic access exploitation) |

---

🔍 Categories

A. Prompt-Based Attacks

#### 1. 🎯 Direct Prompt Injection
Risk: Malicious user inputs that directly alter LLM behavior

Attack Examples:

Ad Techniques:

#### 2. 🌐 Indirect Prompt Injection
Risk: External content containing hidden malicious instructions

Attack :

Case Study: Resume Poisoning

#### 3. 🎭 Jailbreaking Techniques
Risk: Bypassing AI safety mechanisms and content policies

Popular Methods:

B. Data and Privacy Attacks

#### 1. 💾 Sensiti Disclosure
Risk Categories:

Extraction Techniques:

#### 2. 🕵️ Model In Attacks
Risk: Reconstructing training data from model outputs

Attack Methods:

C. System-Le

#### 1. 🏗️ RAG and Database Attacks
Risk: Exploiting Retrie Generation systems

Attack :

RAG Attack Example:

#### 2. 🤖 Agentic AI Exploitation
Risk: Attacking autonomous AI agent systems

Critical :

Agent Attack Scenario:

---

⚔️ Offensi Tools

AI Red Teaming Platforms

#### 1. 🔴 Garak (NVIDIA)
Purpose: Generative AI Red-teaming and Assessment Kit — comprehensive LLM scanner with 100+ attack modules
Capabilities:

#### 2. 🎯 LLMFuzzer
Purpose: Specialized fuzzing for AI
Features:

#### 3. 🔍 Mindgard
Purpose: Enterprise AI red teaming platform
Capabilities:

#### 4. 🆕 OWASP FinBot CTF
Purpose: Practice agentic security skills in controlled en

#### 5. 🆕 DeepTeam
Purpose: Open-source LLM red teaming framework by Confident AI (No 2025)
Capabilities:

#### 6. 🆕 Promptfoo
Purpose: Open-source LLM security testing tool used by 30,000+ de
Capabilities:

Custom Attack Tools

#### Prompt Injection Framework

#### Data Extraction Tool

Jailbreaking Techniques

#### Ad Jailbreak Methods (2025)

🆕 Agentic Attack Tools

#### Agent Goal Hijack Tester

#### Memory Poisoning Tester

---

🛡️ Defensi Tools

Real-Time Guardrails

#### 1. 🛡️ LLM Guard
Purpose: Comprehensi/output filtering
Features:

#### 2. 🏗️ NeMo Guardrails (NVIDIA)
Purpose: Programmable AI safety framework
Capabilities:

#### 3. ☁️ Amazon Bedrock Guardrails
Purpose: Enterprise-grade AI safety at scale
Features:

Ad Protection Systems

#### 1. 🔍 Langfuse Security Integration
Purpose: Obser and monitoring for AI security
Capabilities:

#### 2. 🎯 Custom Security Pipeline

🆕 Agentic Security Tools

#### Agent Behavior Monitor

#### Memory Integrity

#### Tool Usage Guard

Enterprise Security Frameworks

#### 1. 🏢 Zero Trust AI Architecture

---

🏗️ RAG & Security

Understanding RAG

Retrie Generation (RAG) systems combine pre-trained LLMs with external knowledge sources, introducing unique attack surfaces:

#### Critical RAG Security Risks

1. Database Poisoning
- Malicious embeddings in knowledge base
- Cross-contamination between data sources
- Pri escalation through document injection

2. Context Hijacking
- Manipulating retrie
- Injection through external documents
- Semantic search manipulation

3. Multi-Tenant Data Leakage
- Cross-user information exposure
- Inadequate access controls
- Shared space

RAG Security Implementation

#### 1. 🔒 Permission-Aware Database

#### 2. 🕵️ RAG Poisoning Detection

#### 3. 🎯 Context Injection Pre

RAG Security Best Practices

#### 🔧 Implementation Guidelines

1. Access Control Strategy

2. Integrity Monitoring

3. Secure RAG Pipeline

---

🤖 Agentic AI Security

Understanding Autonomous AI Agents

Agentic AI systems represent a new paradigm where LLMs make autonomous decisions and take actions without direct human o. These systems introduce unprecedented security challenges:

#### Agent Architecture Components

Critical Agentic AI

#### 1. 🎯 Excessi (LLM06:2025)
Risk: Agents granted excessi or autonomy

Attack Scenarios:

Secure Implementation:

#### 2. 🔗 Chain-of-Thought Attacks
Risk: Manipulating agent reasoning processes

Attack Example:

Defense Strategy:

---

🆕 Agentic AI Deep Dives

> This section provides detailed co of the OWASP Top 10 for Agentic Applications 2026

ASI01: Agent Goal Hijack 🔴 CRITICAL

Description: Attackers exploit ad inputs, poisoned data sources, or malicious tools to alter an agent's planning, reasoning, and self-e. This extends prompt injection—attackers can inject ad objectives that shift an agent's long-term goals, leading to gradual drift from original objectives.

Attack :

Attack Example:

Mitigations:

ASI03: Identity & Pri Abuse 🔴 CRITICAL

Description: Non-Human Identities (NHIs)—machine accounts, service identities, and agent-based API keys—create unique attack surfaces. Agents often operate under NHIs when interfacing with cloud services, databases, and external tools, lacking session-based o.

Key Concerns:

Secure Implementation:

ASI06: Memory & Context Poisoning 🟠 HIGH

Description: AI agents use short- and long-term memory to store prior actions, user interactions, and persistent state. Attackers can poison these memories, gradually altering behavior through stealthy manipulation that persists across sessions.

Why This Is Different From Prompt Injection:

Attack Example:

Defense:

ASI10: Rogue Agents 🔴 CRITICAL

Description: Malicious or compromised AI agents operate outside normal monitoring boundaries, executing unauthorized actions or exfiltrating data. Decepti may lie, manipulate, or sidestep safety checks while appearing compliant.

Characteristics:

Detection Strategy:

🆕 MCP Security Considerations

The Model Context Protocol (MCP) enables agents to connect to external tools and services, introducing supply chain risks (ASI04).

MCP Security Checklist:

Reference: OWASP Guide to Securely Using Third-Party MCP Servers

---

📊 Security Assessment Framework

Comprehensive LLM Security Testing

#### 1. 🔍 Automated Security Scanning

🆕 OWASP AI Scoring System (AIVSS)

The AI standardized risk assessment specifically for AI systems, with focus on agentic architectures.

Calculator:

#### 2. 📋 Security Checklist

✅ Input Security

✅ Output Security

✅ Model Security

✅ Infrastructure Security

✅ RAG-Specific Security

✅ Agent Security

🆕 ✅ Agentic Top 10 Security

3. 🎯 Risk Assessment Matrix

| Risk Level | Impact | Likelihood | Mitigation Priority |
|----------------|------------|----------------|------------------------|
| Critical | Data breach, system compromise | High | Immediate action required |
| High | Sensitive data exposure | Medium | Address within 24 hours |
| Medium | Service disruption | Medium | Address within 1 week |
| Low | Minor functionality impact | Low | Address in next release |

---

🔬 Case Studies

Case Study 1: Air Canada Chatbot Misinformation (2024)

🚨 Incident O:
Air Canada's customer service chatbot provided incorrect information about berea fares, leading to a legal dispute when the airline refused to honor the chatbot's promises.

💥 Impact:

🔧 Root Cause:

✅ Lessons Learned:

Case Study 2: Samsung Employee Data Leak (2023)

🚨 Incident O:
Samsung employees inad exposed confidential source code and meeting data by entering it into ChatGPT for assistance.

💥 Impact:

🔧 Root Cause:

✅ Mitigation Strategy:

🆕 Case Study 3: Anthropic AI Agent Espionage Disclosure (2025)

🚨 Incident O:
Anthropic disclosed that AI agents were being used in sophisticated cyber espionage campaigns, concerns about agentic AI security risks.

💥 Impact:

🔧 Root Cause:

✅ Lessons Learned:

🆕 Case Study 4: EchoLeak - Microsoft 365 Copilot Zero-Click Attack (2025)

🚨 Incident O:
Security researchers discovered EchoLeak (C), a zero-click prompt injection in Microsoft 365 Copilot that could force the AI assistant to exfiltrate sensiti data to an external URL without any user interaction.

💥 Impact:

🔧 Root Cause:

✅ Lessons Learned:

🆕 Case Study 5: DeepSeek R1 Security (2025-2026)

🚨 Incident O:
Multiple security research firms identified significant security weaknesses in DeepSeek R1, a Chinese-de open-source LLM. CrowdStrike found that politically sensiti triggered increased code rates, while Qualys found it failed 58% of jailbreak tests.

💥 Impact:

🔧 Root Cause:

✅ Lessons Learned:

🆕 Case Study 6: First Malicious MCP Server on npm (2025)

🚨 Incident O:
In September 2025, the first malicious Model Context Protocol (MCP) server was discovered on npm, representing a supply chain attack specifically targeting agentic AI systems.

💥 Impact:

🔧 Root Cause:

✅ Lessons Learned:

---

💼 Enterprise Implementation

🏗️ Secure LLM Architecture

#### 1. Multi-Layer Security Architecture

#### 2. Enterprise Go Framework

---

🆕 AI Regulations & Compliance (2026)

EU AI Act — Key 2026 Milestones

The EU AI Act is the world's first comprehensive AI regulation framework with extraterritorial application (the "Brussels Effect") affecting the global $524B AI market.

| Date | Milestone | Impact |
|----------|--------------|------------|
| Feb 2, 2025 | Prohibited AI practices banned | Subliminal manipulation, social scoring, real-time biometric ID (with exceptions) |
| Aug 2, 2025 | GPAI model obligations effective | Transparency, copyright compliance, safety e for systemic risk models |
| Aug 2, 2026 | High-risk AI systems must comply | Biometrics, critical infrastructure, education, employment, law enforcement, migration, justice |
| Aug 2, 2026 | Article 50 transparency obligations | AI interaction disclosure, synthetic content labeling, deepfake identification |
| Aug 2, 2026 | AI regulatory sandboxes required | Each EU member state must establish at least one AI regulatory sandbox |

Key Requirements for LLM Deployments:

Other Acti Frameworks

| Framework | Scope | Key Requirements |
|--------------|-----------|---------------------|
| NIST AI RMF | US framework | Risk identification, assessment, and mitigation for AI systems |
| ISO/IEC 42001 | International standard | AI Management System requirements for responsible AI de |
| NIST AI 600-1 | US AI security | AI Red Teaming guidelines and generative AI risk profile |

Compliance Checklist for LLM Applications

✅ EU AI Act Compliance

✅ Data Protection

---

📚 Resources & References

🔗 Official OWASP Resources

#### OWASP Top 10 for LLMs 2025

#### 🆕 OWASP Top 10 for Agentic Applications 2026

#### Related OWASP Projects

🛠️ Security Tools and Frameworks

#### Open Source Security Tools

#### Enterprise Platforms

#### Research and Red Teaming Tools

📖 Research Papers and Publications

#### Foundational Research

#### Recent Security Research (2024-2025)

#### RAG and Security

#### 🆕 Agentic Security (2025-2026)

#### 🆕 DeepSeek R1 Security Research (2025)

#### 🆕 AI Regulations & Standards

#### 🆕 AI Security Incident Reports

---

🤝 Contributing

How to Contribute

We welcome contributions from the global AI security community! This guide is maintained as an open-source project to ensure it remains current and comprehensive.

#### 🔧 Ways to Contribute

📝 Content Contributions

🛠️ Tool Contributions

🐛 Issue Reporting

#### 📋 Contribution Guidelines

Content Standards

Technical Requirements

#### 🚀 Getting Started

1. Fork the Repository

2. Create a Feature Branch

3. Make Your Changes
- Update relevant sections
- Add new content following established format
- Test any code examples

4. Submit a Pull Request
- Describe your changes clearly
- Reference relevant issues or discussions
- Include testing e for code contributions

#### 🏆 Recognition

Contributors will be recognized in:

---

📄 License and Legal

📋 License Information

This project is licensed under the MIT License, promoting open collaboration while ensuring attribution and protecting contributors.

⚖️ Disclaimer

🔐 Security Notice

---

<di="center">

🆕 Changelog

February 2026 Update

| Section | Change Type | Description |
|---------|-------------|-------------|
| OWASP Agentic Top 10 | 🔴 Critical Fix | Corrected identifier prefix from AAI to official ASI (ASI01-ASI10) with correct ordering |
| Header/Title | 🔄 Updated | Changed to "2026 Edition", updated badge to February 2026 |
| LLM Ecosystem | 🔄 Updated | Updated to GPT-5.x, Claude Opus 4.6, Gemini 3.x, Llama 4 |
| Security Tools | 🆕 Added | DeepTeam, Promptfoo, ARTKIT, Meta LlamaFirewall/Llama Guard 4 |
| Case Studies | 🆕 Added | EchoLeak (C), DeepSeek R1, first malicious MCP server |
| AI Regulations | 🆕 New Section | EU AI Act 2026 milestones, NIST AI RMF, ISO/IEC 42001 |
| Resources | 🆕 Added | DeepSeek R1 research, AI regulation references, new red teaming tools |
| Security Scanner | 🔄 Updated | Expanded to full ASI01-ASI10 test co |
| All ASI References | 🔴 Critical Fix | All AAI→ASI with corrected numbering across entire document |

December 2025 Update

| Section | Change Type | Description |
|---------|-------------|-------------|
| Header/Badges | 🔄 Updated | Added Agentic AI badge |
| Breaking Update | 🆕 New | Added prominent announcement for Agentic Top 10 |
| What's New | 🔄 Expanded | Added Agentic Top 10 summary table |
| Understanding LLMs | 🆕 Added | "What is Agentic AI?" subsection |
| OWASP Agentic Top 10 | 🆕 New Section | Complete co of ASI01-ASI10 |
| Offensi | 🆕 Added | Agent Goal Hijack Tester, Memory Poisoning Tester |
| Defensi | 🆕 Added | Agent Behavior Monitor, Memory Integrity , Tool Usage Guard |
| Agentic AI Deep Dives | 🆕 New Section | Detailed co of ASI01, ASI03, ASI06, ASI10, MCP Security |
| Security Checklist | 🆕 Added | Complete Agentic Top 10 checklist (10 new items) |
| Security Scanner | 🔄 Updated | Added agentic test suites |
| Case Studies | 🆕 Added | Anthropic AI Agent Espionage case study |
| Enterprise Architecture | 🔄 Updated | Added AgentSecurityLayer |
| Resources | 🆕 Added | All new OWASP Agentic Security publications, AIVSS |

---

🌟 Join the Mission

Securing AI for E

This guide represents the collecti of cybersecurity professionals, AI researchers, and industry practitioners worldwide. By contributing, you're helping build a more secure AI ecosystem for all.

Star ⭐ this project to show support
Share 📤 with your professional network
Contribute 🤝 to keep it current

---

© 2024-2026 LLM Security Guide Contributors | MIT License | Community Driven

*Last Updated: February 2026 with OWASP Top 10 for LLMs 2025 & OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10)*

</div>

项目信息

开发语言：未知

Star 数：155

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A comprehensive reference for securing Large Language Models (LLMs). Covers OWASP GenAI Top-10 risks, prompt injection, adversarial attacks, real-world incidents, and practical defenses. Includes catalogs of red-teaming tools, guardrails, and mitigation strategies to help developers, researchers, and security teams deploy AI responsibly.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。